Security and data
Written for the people who review software for schools: IT managers, privacy leads, and anyone a principal asks to look something over. The privacy page covers the same ground in plain English for teachers and parents; this page covers how it is built. Both are written to be forwarded.
What Markpilot is, in one paragraph
A web application for teachers. It reads marked or unmarked student assessment papers, records marks, and drafts report comments and student feedback that the teacher edits and approves. There is no student login, no parent login, and nothing is sent to a student or parent by Markpilot: teachers export documents and distribute them through their normal channels.
Architecture
- Front end: static pages served by Vercel. Student PDFs are rendered to images in the teacher's browser; original files are never uploaded.
- APIs: serverless functions on Vercel. Every request is authenticated and every query is scoped to the signed-in teacher's account.
- Database and storage: Supabase (PostgreSQL and object storage), hosted in Singapore. Row-level security is enabled on every table; the browser never queries the database directly, and all access goes through the authenticated APIs.
- AI processing: Anthropic (Claude), processed in the United States. Data submitted through the API is not used to train models, under Anthropic's commercial terms.
- Traffic: HTTPS throughout. Data at rest is encrypted by the database provider.
Authentication and access
- Sign-in is with a Google or Microsoft account only. Markpilot never sees or stores a password.
- Teachers may use a school or personal account; a school Microsoft tenancy may require IT approval before staff can consent to new sign-ins, which is a control that stays in your hands.
- All records are locked to the account that created them. There is no cross-account access, and no staff-facing admin surface exposes student work.
Student data
- The teacher chooses how students are identified. First names or initials are enough; Markpilot never generates its own student identifier.
- Original files never leave the browser. What is uploaded is downscaled images of marked answer pages, kept in a private bucket, reachable only through short-lived signed links.
- Everything derived from student work is time-bounded. Answer-page images and transcribed text are kept for one school year from last use, then removed by a daily job. Teachers can delete any student's scans at any time, which also deletes the text extracted from them.
- Never used to train AI models. Not by Markpilot, and not by Anthropic under its API terms.
- The full inventory of what is stored and why is on the privacy page.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage | Singapore |
| Anthropic | AI processing (marking, drafting) | United States |
| Vercel | Hosting and serverless functions | Global edge; functions in the US |
| Stripe | Payments. Card details are held by Stripe, never by Markpilot | Global |
| Resend | Transactional email to teachers | United States |
| Google Analytics | Page and feature usage on the website | Global |
Offshore processing is a fact of this architecture, stated rather than buried: the database is in Singapore and AI processing is in the United States. If your school or system cannot accept offshore processing of student identifiers, Markpilot in its current form will not pass your review, and it is better that this page tells you so than that you find out after a deployment.
Deletion
- Deleting a task, class, or account cascades: marks, comments, rosters, images and transcripts go with it.
- Per-student scan deletion is available to the teacher at any time.
- Teachers can export their marks and comments (spreadsheet and PDF) at any time, so leaving does not strand anything.
What Markpilot does not have yet
Honesty about the current state, so your review starts from facts:
- No SAML or school-managed SSO beyond Google and Microsoft sign-in.
- No third-party certifications (ISO 27001, SOC 2) and no independent penetration test yet. Internal adversarial security review has been done; independent review is intended as the product grows.
- No signed data processing agreement template yet; one is in preparation.
- The privacy policy has not yet been reviewed by a lawyer.
- One person builds and operates Markpilot. The continuity answer is the export path above, and the deletion story: nothing is held hostage.
Markpilot is a product of No Drama Studios Pty Ltd · built and run by a registered secondary teacher · hello@markpilot.co · Privacy